Import Ubuntu patches

1 files changed, 58 insertions, 0 deletions

diff --git a/debian/patches/Update-dnsmasq-parameters.patch b/debian/patches/Update-dnsmasq-parameters.patch
new file mode 100644
index 00000000..24c75a3c
--- /dev/null
+++ b/debian/patches/Update-dnsmasq-parameters.patch
@@ -0,0 +1,58 @@
+From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stephane.graber@canonical.com>
+Date: Thu, 12 May 2016 22:44:06 +0800
+Subject: Update dnsmasq parameters
+
+Disable caching since it's a potential security issue (local dns cache poisoning).
+
+See also: https://blueprints.launchpad.net/ubuntu/+spec/foundations-p-dns-resolving
+---
+ src/dns/nm-dns-dnsmasq.c | 4 ++--
+ src/dns/nm-dns-manager.c | 8 ++++----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/src/dns/nm-dns-dnsmasq.c b/src/dns/nm-dns-dnsmasq.c
+index 3ec1fd2d..9309c0ec 100644
+--- a/src/dns/nm-dns-dnsmasq.c
++++ b/src/dns/nm-dns-dnsmasq.c
+@@ -504,8 +504,8 @@ start_dnsmasq (NMDnsDnsmasq *self)
+ 	argv[idx++] = "--no-hosts"; /* don't use /etc/hosts to resolve */
+ 	argv[idx++] = "--bind-interfaces";
+ 	argv[idx++] = "--pid-file=" PIDFILE;
+-	argv[idx++] = "--listen-address=127.0.0.1"; /* Should work for both 4 and 6 */
+-	argv[idx++] = "--cache-size=400";
++	argv[idx++] = "--listen-address=127.0.1.1"; /* Should work for both 4 and 6 */
++	argv[idx++] = "--cache-size=0";
+ 	argv[idx++] = "--clear-on-reload"; /* clear cache when dns server changes */
+ 	argv[idx++] = "--conf-file=/dev/null"; /* avoid loading /etc/dnsmasq.conf */
+ 	argv[idx++] = "--proxy-dnssec"; /* Allow DNSSEC to pass through */
+diff --git a/src/dns/nm-dns-manager.c b/src/dns/nm-dns-manager.c
+index 754fb80f..3dbf2f7e 100644
+--- a/src/dns/nm-dns-manager.c
++++ b/src/dns/nm-dns-manager.c
+@@ -1164,12 +1164,12 @@ update_dns (NMDnsManager *self,
+ 		;
+ 	}
+ 
+-	/* If caching was successful, we only send 127.0.0.1 to /etc/resolv.conf
++	/* If caching was successful, we only send 127.0.1.1 to /etc/resolv.conf
+ 	 * to ensure that the glibc resolver doesn't try to round-robin nameservers,
+ 	 * but only uses the local caching nameserver.
+ 	 */
+ 	if (caching) {
+-		const char *lladdr = "127.0.0.1";
++		const char *lladdr = "127.0.1.1";
+ 
+ 		if (NM_IS_DNS_SYSTEMD_RESOLVED (priv->plugin)) {
+ 			/* systemd-resolved uses a different link-local address */
+@@ -1558,7 +1558,7 @@ nm_dns_manager_stop (NMDnsManager *self)
+ 	_LOGT ("stopping...");
+ 
+ 	/* If we're quitting, leave a valid resolv.conf in place, not one
+-	 * pointing to 127.0.0.1 if any plugins were active.  Thus update
++	 * pointing to 127.0.1.1 if any plugins were active.  Thus update
+ 	 * DNS after disposing of all plugins.  But if we haven't done any
+ 	 * DNS updates yet, there's no reason to touch resolv.conf on shutdown.
+ 	 */
+-- 
+2.14.1
+